Exploitation observed; activity peaked at 5 mentions and remains active
Immediate actions
Patch amd radeon_pro_w5500 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Recommended action window: Immediate (within 24h)
NVD description
An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over arbitrary hardware ports or physical addresses resulting in a potential arbitrary code execution.
Lunex is using BYOVD to blind EDR, not just kill it.
Fake CAPTCHA → AMD PDFWKRNL.sys (CVE-2023-20598) → zeroes kernel callbacks → LunexStealer + sticky Native Messaging Host persistence.
Write-up by @PolySwarm, original research by Ontinue:
https://hs-5737925.f.hubspotemail.net/hubfs/5737925/Threat%20Bulletins/PolySwarm%20Threat%20Bulletin_%20Lunex%20Uses%20BYOVD%20to%20Disable%20Security%20Monitoring%20and%20Deploy%20Persistent%20Stealer%20_09-29-26.pdf
Post summary
The tweet discloses that the Lunex stealer leverages BYOVD and CVE-2023-20598 in AMD PDFWKRNL.sys to nullify kernel callbacks, enabling persistent theft, as detailed in a PolySwarm threat bulletin.
Came across a really interesting BYOVD chain recently
The loader transitions execution from user mode to kernel mode without triggering UAC, downloads ntkrnlmp.pdb from Microsoft’s symbol server, decrypts the AMD PDFWKRNL.sys driver vulnerable to CVE-2023-20598, and zeroes kernel callbacks associated with 20 security drivers across seven vendors. This blinds EDR products before the loader deploys what we are tracking as a new information-stealing malware family called Lunex, targeting the CIS region.
Final payload after BYOVD blinds EDR: psychedeliclove.exe, full C2 agent. 7 browsers, 6 wallets, Chrome/Edge NMH persistence via com.lunex.explorer. Triple persistence. Live C2 panel at time of analysis.
I have been unable to find any documented technical analysis of the binary. However, I discovered that @btcoolteam conducted OSINT research into the Lunex panels in June, which appears to be related. I will be publishing a blog with a more detailed analysis soon.
IOCs:
hxxp[://]107[.]175[.]82[.]242[:]9000/wilow/psychedeliclove[.]exe
hxxp[://]193[.]178[.]159[.]128[:]8080
uasputnik[.]com
Loader: bf14cd6c3328ebd08e940478b5d1da04e9e5aa576d045d41950bf4f1e2456dd8
Driver: 6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1
Stealer: 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90
#malware#BYOVD#threatintel
Post summary
The text describes a real-world BYOVD attack chain leveraging CVE-2023-20598 to deploy the Lunex information stealer, providing IOCs and indicating active exploitation.
Lunex Stealer blinds EDR first, then empties the browser.
It loads a vulnerable AMD Radeon driver (PDFWKRNL.sys, CVE-2023-20598) as BYOVD to kill security tools, then steals passwords and session cookies from seven Chromium browsers plus crypto wallets. ClickFix fake CAPTCHA to MSI, UAC bypass via CMSTPLUA. Alert on vulnerable or unsigned driver loads, and treat random Cloudflare-verify Run prompts as hostile.
Post summary
Lunex Stealer exploits CVE-2023-20598 in a vulnerable AMD Radeon driver to disable security tools and steal browser data, while the post also recommends monitoring for unsigned driver loads and treating suspicious Cloudflare-verify prompts as hostile.
SOCの「プロセスは動いている」が安心材料にならない。これは嫌な手口だ。
The Hacker Newsが伝えるOntinueの分析では、Lunex StealerはAMDのPDFWKRNL.sys（CVE-2023-20598）を悪用し、セキュリティ関連プロセスを動かしたまま監視を無効化するという。
入口は侵害されたウクライナのサイトに置かれた偽Cloudflare認証。そこから監視の無効化、ブラウザー認証情報の窃取へ進む4段階のつながりが、記事で追いたいところ。
私が引っかかるのは、監視する側がこの沈黙をどう見分けるか。プロセスの生存と、検知に必要なイベントが届いていることは別だ。「アラートがない」を正常と判断する根拠は、どこにあるだろう。
https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html
Post summary
The text discusses the Lunex Stealer malware exploiting CVE-2023-20598 in AMD drivers to disable security monitoring, but does not explicitly report active exploitation, provide PoC/exploit code, mention patches, or detail the vulnerability's technical specifications. It serves as a commentary on detection blind spots.
Lunex runs a BYOVD chain abusing AMD Radeon driver CVE-2023-20598 to zero kernel callbacks and leave EDR tools running but blind.
IOCs (6):
teamwork-recover-password[.]com
whatsappbusineses[.]com
ibraq-perfumes[.]com
+3 more
Full set: https://threatcluster.io/cluster/lunex-malware-targets-ukrainian-users-with-byovd-exploit-7292ba60?utm_source=x&utm_medium=tweet&utm_campaign=vt_comment_bot
Post summary
The text reports active exploitation of CVE-2023-20598 by Lunex malware using a BYOVD technique to disable EDR kernel callbacks, and shares associated IOCs with a link to a detailed threat analysis.
2/5 The infection begins on compromised websites with a fake Cloudflare verification prompt.
Victims are directed to run an MSI installer, which launches LunexLoader, bypasses UAC through the CMSTPLUA COM object and loads PDFWKRNL.sys. CVE-2023-20598 enters the chain.
Post summary
The text outlines a malware infection chain that leverages CVE-2023-20598 to bypass UAC and load a malicious driver, indicating the vulnerability is being actively exploited in the wild.
LunexStealer uses PDB-guided BYOVD via a vulnerable AMD driver (CVE-2023-20598) to silently blind endpoint security before stealing credentials and planting a persistent Native Messaging Host on Ukrainian 🇺🇦 targets.
Key findings:
- The infection chain starts with a fake CAPTCHA page on uasputnik[.]com, which instructs victims to run an msiexec command that silently installs a malicious MSI from %LOCALAPPDATA%, no admin required at first. LunexLoader then fakes a trusted Windows binary via PEB manipulation, abuses the CMSTPLUA COM object for UAC bypass, and installs AMD's PDFWKRNL.sys (CVE-2023-20598) as a service, gaining kernel read/write through exposed IOCTL calls, all before the stealer touches disk.
- The BYOVD implementation is unusually surgical. LunexLoader reads the victim's ntoskrnl.exe, extracts the PDB GUID for the running kernel build, and pulls matching symbols from Microsoft's Symbol Server using curl.exe. It then parses the PDB to resolve exact offsets for process, thread, and image-load callback tables, making the technique version-agnostic across Windows 10 and 11. It zeros callback entries belonging to a 20-entry blocklist that includes Microsoft Defender, CrowdStrike, SentinelOne, ESET, Elastic, Kaspersky, Dr[.]Web, Sysmon, and Windows Filter Manager. Targeting Filter Manager can disable entire classes of minifilter-based products at once. Validated testing found that neither HVCI nor the then-current Microsoft Vulnerable Driver Blocklist blocked the specific PDFWKRNL.sys variant used.
- LunexStealer targets Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi, pulling credentials, cookies, tokens, and card data. It handles Chrome App-Bound Encryption and ChaCha20-Poly1305 (versions 10, 11, and 20). Crypto wallet targets include Bitcoin Core, Litecoin, Exodus, Atomic Wallet, Electrum, MetaMask, OKX Wallet, and SafePal Wallet.
- Persistence is layered: a registry Run key, a hidden scheduled task named psychedelicloveUtils, and Chrome and Edge Native Messaging Host registrations under the name com.lunex.explorer. The Native Messaging Host embeds PowerShell capable of drive enumeration, directory listing, file read/write, file download, and arbitrary execution. Ontinue confirmed it survives deletion of the stealer binary, reboots, and browser restarts, meaning removing LunexStealer.exe is not remediation.
- Ontinue identified 28 Lunex panels across 13 countries and assesses the platform as a Russian-speaking MaaS operation with CIS alignment, sold to independent criminal operators. The "Psychedelic" operator tag appears in the scheduled task name psychedelicloveUtils. Three samples are confirmed associated with this activity: bf14cd6c3328ebd08e940478b5d1da04e9e5aa576d045d41950bf4f1e2456dd8, 6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1, and 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.
Responder takeaway: Do not treat a live EDR process as proof of functioning visibility after a BYOVD incident. Hunt for curl.exe contacting Microsoft's Symbol Server, PDFWKRNL.sys loaded as a service, and the Native Messaging Host registry entries for com.lunex.explorer in both HKCU and HKLM Chrome and Edge NativeMessagingHosts keys. Check for a scheduled task named psychedelicloveUtils. On any system where LunexLoader ran, assume kernel callbacks may have been zeroed and validate telemetry coverage independently before trusting endpoint logs from that window.
#DFIR_Radar
Post summary
The text describes active in-the-wild exploitation of CVE-2023-20598 by LunexStealer/LunexLoader to disable endpoint security and steal credentials from Ukrainian targets, with no mention of patches or public exploit code.
Lunex Stealer drops PDFWKRNL.sys to exploit CVE-2023-20598.
Infection starts on compromised Ukrainian sites via fake CAPTCHA pages serving MSI installers. LunexLoader runs first, bypasses UAC with the CMSTPLUA COM object, then loads the AMD Radeon driver through BYOVD.
The driver disables security monitoring processes without killing them.
It pulls passwords, cookies, and autofill from exactly seven Chromium browsers. Five desktop wallets and four extensions, including MetaMask and OKX Wallet, also get hit.
Persistence lands via a Registry Run key, scheduled task named psychedelicloveUtils, and a 13,200-byte PowerShell script backing a Chrome Native Messaging Host. The NMH handles file ops in 512 KB chunks and beacons to 193.178.159[.]128 over HTTP.
The malware edits Chrome Secure Preferences to inject an extension with broad URL permissions.
Driver abuse keeps security tools running while the theft completes.
Post summary
Lunex Stealer actively exploits CVE‑2023–5598 by loading a vulnerable driver to disable security tools and steal credentials from browsers and wallets.
AC-0277: ClickFix on 100+ sites, smart-contract config (Polygon/Ethereum), and LUNEXSTEALER.
One path uses an AMD driver (CVE-2023-20598) missing from the April 2026 Microsoft blocklist copy I examined.
https://blog.marcfredericgomez.com/uac-0277-clickfix-smart-contracts-and-lunexstealer/
Post summary
The text reports a ClickFix campaign affecting more than 100 sites, with LUNEXSTEALER and an exploitation path involving the AMD-driver CVE-2023-20598. It identifies a Microsoft blocklist omission but provides no specific patch or workaround.
Lunex MaaS (aka Psychedelic Stealer) abusing a vulnerable AMD Radeon kernel driver (PDFWKRNL.sys / CVE-2023-20598 BYOVD) to blind security tools — then steal Chromium credentials, session cookies, and crypto wallets. ClickFix fake-Cloudflare lures on compromised Ukrainian sites. Ontinue + Arctic Wolf via THN / AM.
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
https://www.anonymousmedia.org/2026/09/26/lunex-stealer-abuses-amd-driver-to-disable-security-monitoring-and-steal-browser-credentials/
Post summary
The text discloses how the Lunex stealer abuses CVE-2023-20598 in the AMD Radeon kernel driver to disable security monitoring and steal credentials, without mentioning patches, exploits, or active exploitation claims.
TRC analysis shows Lunex Stealer exploiting vulnerable AMD drivers (CVE-2023-20598) to disable security monitoring before harvesting browser credentials. Attackers use BYOVD techniques to gain kernel privileges, then establish persistence across multiple browser contexts. Runtime segmentation helps limit post-compromise lateral movement. #ZeroDay#CloudSecurity
:link: Full TRC analysis: https://aviatrix.ai/threat-research-center/lunex-stealer-amd-driver-cve-2023-20598-byovd-2026
Post summary
The text reports that Lunex Stealer is exploiting CVE-2023-20598 in AMD drivers using BYOVD techniques to disable security monitoring and harvest credentials, with runtime segmentation suggested to limit lateral movement.
